As modern workspaces extended beyond physical offices across continents and attackers shifted from exploit-based “breaking in” to using compromised credentials/keys to “logging in”, perimeter-based security became ineffective. The attack surface has become borderless, and organizations are facing emerging risks, like tech sprawl and exposed vendors.
Zero trust has gone from being a buzzword to becoming a necessity. But what is zero trust really? Why are modern organizations counting on it to keep their data, progress, and reputation secure? Through our blog, we will take a look at what zero trust is and how organizations can implement it.
What is zero trust?
Zero trust is a security model that requires verification of every access request by users before it is granted, against context, device health, and identity.
Unlike the castle and moat traditional security model, zero trust eliminates implicit trust.
The core principles of zero trust
These three principles together form the core of zero trust:
Never trust, always verify
Every access request is verified, every time, throughout the session. So, whether it is the user, device, or an application from inside or outside the network, it is not trusted.
Use least privileged access
According to this principle, users should be given the minimum permission needed to perform their task.
Assume breach
It requires organizations to build their security architecture by assuming a compromise. For example, enabling logging and monitoring for the detection of suspicious behaviors before they turn into threats.
How to implement it? – A five-stage process
The following is a five stage zero trust implementation roadmap with timeline –
Stage 1 – Audit of identities (Month 1st and 2nd)
- Because you cannot implement least privilege if you don’t know all the identities
- Take an inventory – of all the human and machine identities across your environment.
- Identify inconsistencies – Identify stale accounts, credentials that aren’t rotated, and over-privileged roles
- Mandate MFA – across all the accounts
Stage 2 – Pilot Zero Trust on one application (Month 2nd to 4th)
It can help you detect implementation issues early on, before scaling at an organizational level.
- Select a single application – that is most externally connected/at risk/most accessed.
- Apply Zero Trust controls – least privileged access, continuous behavior logging, and continuous verification.
- Measure and build – observe, measure, and mitigate the gaps in implementation before scaling it at the organization level.
Stage 3 – Layer Zero Trust controls (Month 4th to 8th)
Roll out Zero Trust policies and controls
- Implementing Zero Trust policies- across user-facing applications.
- Implement role-based access controls – as per the job functions of users across the organization
- Enforce conditional access policies – as per device health, location, and risk score
Stage 4 – Microsegment networks – (Month 6th to 12th)
Micro-segmenting prevents lateral movement, even with authentication, by isolating the workloads and applications
- Break flat network into small segments – as per user groups, app types, workload categories
- Apply security policies – for each segment as per their requirements
- Implement continuous verification – where each attempt is verified
Stage 5 – Enforce zero trust fully and continuously monitor
This is a stage where Zero Trust is mature, where you enforce the policies, procedures, & measures, continuously monitor for deviations, and improve.
- Deploy behavioral analytics and SIEM
- Set automated response policies for suspicious access patterns
- Run tabletop exercises to validate your assumptions about damage
The real cost of implementing zero trust (TCO)
The cost of implementing zero trust stage wise cost
For mid-level enterprises with 200-500 users, the total cost of ownership over 2 years is as follows:
1. Initial implementation (year one) – $200k to 500k
Including:
- 30k – 120k for Identity
- 40-80k for Device security
- 40k – 200k for Microsegmentation
- 25k – 150k for Monitoring & analytics
- 50k – 150k for integration & consulting
2. Licensing
- $15- 35 per user per month for 200 users
- 2-year total – $72k – 420k
3. Operational cost
$50k – 150k over 2 years
Including
- Policy tuning & maintenance
- SOC/MDR
- User onboarding + support
- Training & change management
Overall, the TCO for a 200-500 user company, practically, can be approximately $300k to 500k for two years.
The factors that impact the overall cost are as follows:
Factors that drive the cost up:
- No foundational IAM/MFA
- Legacy apps that need custom integration
- Segmenting giant networks that can be costly
- No visibility of assets (inventory alone can cost $20k to 100k)
Factors that bring the cost down
- Using existing tools
- Rolling out in phases
- Starting with high-risk assets only
How long does it take to implement zero trust?
It depends on the size, the security stack, and the current security posture of organizations. For enterprises that are going from scratch, it could take around 12-18 months, while meaningful security improvements like implementing identity auditing and Multi-Factor Authentication throughout the organization can take from 30 to 60 days. Full-scale implementation based on pilots on high-risk applications can take around 90 days.
Is Zero trust right for you?
A checklist that can be used by organization to determine whether they need zero trust
We have prepared a self-assessment checklist for you to guide you with your action. If you score anywhere between 0-2 yes answers, you have to optimize what you have and tighten your existing security controls, like enforcing MFA, auditing privileged access, and segmenting critical assets. A full migration to zero trust is not needed yet.
If your score is 3-5 yes answers, then you have to plan zero trust within the next 12 months since your organization has partial exposure, but not at a critical threshold. You can start by building a roadmap with identity controls and by piloting on any high-risk application.
If your score is 6-8 yes answers, then you have to migrate immediately to zero trust within 90 days, as you have multiple high-risk points across infrastructure, like remote access, cloud exposure, sensitive data, and compliance obligations.
